Core concepts · 07

Audit evidence

The audit trail is the system's native output. Every governed decision, and separately every execution outcome, lands as its own record.

Anatomy of a record

Audit record

kd_evt_29fa41 · 2026-08-13T09:00:41Zdecision: allow · repo.deploy { env: staging }agent kd_agt_7c2 · acting for release-eng · device kd_dev_31b0policy deploy-guard v14 · scope repo:deploy grantedoutcome: executed at provider · recorded separatelyappended to the organization's trail

Timestamp, actor chain, action, deciding policy version, decision, and, separately, the outcome.

The two facts that matter most are deliberately separate. Decision is what Keydris concluded: ALLOW, REJECT, or APPROVAL REQUIRED. Outcome is what then happened at the provider: an allowed action can still fail there, and the record says so. Conflating these two is how audit systems lie by accident; Keydris records them as distinct fields.

Integrity

Records are appended rather than edited in place, and customers cannot delete them through the Services. Revocation never rewrites history. A revoked agent's past actions remain exactly as recorded, which is precisely what makes the trail usable as evidence.

Working with the trail

Browse and filter by timeframe, agent or principal, action type, decision, and outcome. Free-text search covers statements and identifiers.
Inspect any event for its full context: the KIT that accompanied it, the policy version that decided it, and the session it belonged to.
Export the selected timeframe as an evidence file for reviews and compliance workflows.

Note

Audit history retention and export depth are plan-level commercial terms. Keydris has not yet published a formal retention schedule. Do not infer one from these docs.

Scope of the record

Verified behavior

The trail records governed activity: authorization decisions, execution outcomes, and administrative changes (policy edits, enrollments, revocations). Actions that never passed through the broker or Reader are not governed and therefore not recorded. The audit trail is honest about its own boundary.